Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54732— libreoffice-convert: path traversal / arbitrary file write

Quick assessment

Affected
elwerene libreoffice-convert
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libreoffice-convert 是一个用于将 Office 文档转换为不同格式的 Node.js 模块。在 1.8.2 版本之前，index.js 在调用 path.join(tempDir.name, fileName) 时，直接使用了由调用方控制且未经处理的 options.fileName 值，未将其简化为基本文件名（即缺少对路径的归一化处理）。因此，如果文件名中包含 "../"，就可能逃逸出临时目录，因为代码中缺少 path.basename() 的归一化步骤。攻击者可以借此将提供的文档缓冲区写入进

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54732

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libreoffice-convert: path traversal / arbitrary file write
Source: CVE Program / CVE List V5
Vulnerability Description
libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elwerene libreoffice-convert < 1.8.2 -

II. Public POCs for CVE-2026-54732

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54732

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54732 (1)

Vendor Advisories for CVE-2026-54732 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-54732

No comments yet

Leave a comment